General
Target

http://coopertbrance.com

Filesize

N/A

Completed

20-05-2022 02:38

Task

behavioral2

Score
5/10
Malware Config
Signatures 5

Filter: none

Defense Evasion
  • Detected potential entity reuse from brand whatsapp.
  • Modifies Internet Explorer settings
    iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (data)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b091500000000020000000000106600000001000020000000af8febcdda63e5e813f610c3da52cf3d3bc9a09cf10d40db3b3358c9dc6867e2000000000e8000000002000020000000640cd9c6867dfcae0f5f86de2d5cec24997c59c62d79f1bea2532ce3464c0bc710000000fa46e98eca32a5f9153c6af6f017b441400000007c5f2c0f4abbda8f52bf184de41e1805546ce070b9101f82d2a2e86d988e7694a19eb91d04039dad71c219f2cd429aac9399ea5539634ab2ae2dccc62263f4c8iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "359786357"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\SearchScopesiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\AskUser = "1"IEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b0915000000000200000000001066000000010000200000007d43b333495b971ea706285703ebeee0273f0362132186d21861cb82ae247770000000000e8000000002000020000000328e47b333e58a4cc1cea7365125b322b09024944e8bdaa9e04c85814063817350000000628949407f1063238b372ead6e148a3311f3d591be1f23bac3f7d67aebe5275d2d03e7c876d9599277bc07aba42a4ddfa724efbc5a897096191ea1accae4a9e1d6340f2a3c2c9fa167f18f895e7ad0e1400000000aeebe2f4e37909db36e0a9091569a7a9086d4770be08da22d350f8faa1744332eca9cf58914926b55193b4c0dcd026720ebe42e34bb6ebf2cce73039d5bdb80iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IENTSS"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8038db40036cd801iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNamesiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\User Preferencesiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1001088954"IEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b091500000000020000000000106600000001000020000000fd61a589b5ed2d2304644fa1d120f89d41c88dfcd66d550fa221d1c4da986969000000000e800000000200002000000056dc4384d4d762faaa4b932cfeabe3c321891f55853f937eef1631255666746120000000c9b4f54db627f693d17de583b4235bc4f463db0bc755b142ee6847f8e735dcdd40000000490dfe247a7aa8b3a0e073684dd202d00aadc3b0d86ee685eff6575e16b71bbed29a78fff0379a397241ffc5edd92c08a6d7e5278d29c1e9d20ca64840e7440eiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30960643"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{662690DD-D7F6-11EC-AC67-6E95B8993B04} = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"IEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30960643"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\IESettingSyncIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "982964778"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a036fa44036cd801iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b091500000000020000000000106600000001000020000000fd3f9946b58b965e1b6981dd210773e1cc0b388426bf7a01788ad416d38bf0af000000000e80000000020000200000002cf81c173c5ddfc6a327036d5c289f18d784f987ac241cf72b84c69aa8eb93fe200000003a1bfb0aff900d318dcdcb2c25f6de4cc2b66f24395d8345053b55ddb06a0bee4000000067211768293352793c1843e3dff54ab84dded3919c112c790aa819717358e68fc1283a805cf5a9411ecf4b4c33e5b48d238fb39936291b5a20ac3431881a316ciexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestioniexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\VersionManageriexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30960643"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\VersionManagerIEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b09150000000002000000000010660000000100002000000095923fa832d12ec8503e5ebc63f69a40693ed3ab8614d01083fbecf00cd9db28000000000e800000000200002000000029f8c71c2775c34e07e7783651d442832c5bcbfb983f7f7cd262b74846923185200000002259850a58f7eb67d8ce748c07574aa15f17fc9136435b678c066dd04225583540000000db19ece531cb7b15bc59556fb34e3a052be212dee861cfea8bcaced26dbcb47338d7e1581e30610aa94a44dde3c30c77843be2922f4859add91df4eeb04e2c6fiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b091500000000020000000000106600000001000020000000d45f391a48f8b213b42fe0e71bb35beac666b034c7f0537607b3d1981b39d509000000000e8000000002000020000000c6aeccc4abe88bde72b5bd57831f63e8a1565c4abac30d4940c019b683b46ab4a0000000e3714ce1b38a2585dcd48fd513d7b258a518bbe04c176953d20c5c6ae8bd2358152fdc418f44cc8a8c82625aae911db631ed8a563a3f902be27f07fcaa08a7740b8d6d27613ef63882fd05d7ab78ed74e26c0da9937ec59142e2d4355b39035dceb4c1d0b118b5ffe66d64a483f2116dacb8a0a848f24f8fa2d391955e8ef57b4da06b0219bbd3490616f887498a7c5533e7ac905c805ef91bb7a154bfdd355c400000009031225f69e71e28123b51fa398b57d41ee016e698fd274e0d1886bfb71a9aae3e725383ee451c005aba599c521f802167570d52f5ec6e56a64807552af52e64iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\DomainSuggestioniexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\IntelliFormsIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\TabbedBrowsingiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b023043e036cd801iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = f982cdb29d50d801iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b0915000000000200000000001066000000010000200000007dcc162d619778e5dd3d6c53d10e69da6cd86117827d5be4a2166eba07e961fb000000000e8000000002000020000000443911979ba351f6797a729f901baabd803c81f63a9294a23a2d5c0974f061c920000000a364afe611e809cc3e6f43e6d2879e7701d03e25a126f291bae9f3f6fd0eb2ea40000000eb01b99016587c72376127f6d7f5c60a08b1f1e05da176b615da9e92e4951daee9784c0b7cd976082c99954e0579d0186a40ce74cdc20661958422deeb303851iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
  • Suspicious use of FindShellTrayWindow
    iexplore.exe

    Reported IOCs

    pidprocess
    2684iexplore.exe
  • Suspicious use of SetWindowsHookEx
    iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

    Reported IOCs

    pidprocess
    2684iexplore.exe
    2684iexplore.exe
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3672IEXPLORE.EXE
    3672IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
    3660IEXPLORE.EXE
  • Suspicious use of WriteProcessMemory
    iexplore.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2684 wrote to memory of 36602684iexplore.exeIEXPLORE.EXE
    PID 2684 wrote to memory of 36602684iexplore.exeIEXPLORE.EXE
    PID 2684 wrote to memory of 36602684iexplore.exeIEXPLORE.EXE
    PID 2684 wrote to memory of 36722684iexplore.exeIEXPLORE.EXE
    PID 2684 wrote to memory of 36722684iexplore.exeIEXPLORE.EXE
    PID 2684 wrote to memory of 36722684iexplore.exeIEXPLORE.EXE
Processes 4
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://coopertbrance.com
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:17410 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3660
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:17414 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3672
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
    PID:4764
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                          MD5

                          003a496cfd41526dddbe8b00273a047f

                          SHA1

                          f59d563a2a66fe14a3f7787a00e96359aedb5ab8

                          SHA256

                          c7a19cd00fd53275f30a71c8f5d87161e5caff68207f4069079ea1448a9ebf41

                          SHA512

                          e4601d093066d6b28e0d99057218f7fb2501fcf24d59b46e0b7babcd24408f4cf0739873b5e74580d6b7a49df6af5ddcc241875ab4633a872a2262b7e7e0b191

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                          MD5

                          c0fce0216dbbc26377305299fc28d167

                          SHA1

                          66f0d300a6ebefd3be44bbf0aaab485ca85f688a

                          SHA256

                          426588b3560b79a18059eedfd0c6422accbaa06e954ac1f5f014e5bba0ab5e4b

                          SHA512

                          5536becc2a18074d22a9aa9627bf9c128a6849b2e4ca73be924f7405e96212ad5aac33b316f34093a2d80877c8fc630fec0fb5af5ef0c7d7117221b641df6deb

                        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2klo80q\imagestore.dat

                          MD5

                          8b9c3217be4451e37a2439a63de1b060

                          SHA1

                          3dd0618240047dbd13607b2a0d08303d89337777

                          SHA256

                          c9e827823f9b9c9da9fe563beebfe05ed3d2421fc1ebd2548b8fc68b184704b8

                          SHA512

                          ff0fcf35a27b4edf37553354ef277c9cce88bdd54850162b56426d6a3b9fcc2007767d69c39fc5c2c0c16a7cdef62ec791da8852aea2b34ac8eafa5faed61639

                        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2klo80q\imagestore.dat

                          MD5

                          dda45d939e48105a83973c1b8a022c7e

                          SHA1

                          0bc1fe2fdcc3930ba6638f52835598630f0fb36d

                          SHA256

                          13e7f31bb56afdb291c0e33ed67a2aa5ed33124e61d744bb37d33c7345d7bd2c

                          SHA512

                          bc6e601b8cafea5b082f2b2b79e76c0cbaafc40d9002cfa61ff40a85a2da28cc37699bdd30c90044471224d0c8d4bdece1773073c8c1ba85f524f772a981e940